CVE-2026-111162: WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmp
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser WMParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidiGetInfo().
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using WildMIDI through version 0.5.0 are exposed when they parse attacker-controlled .hmp files. The attacker must be able to get a crafted file processed by the application, which requires user interaction according to the supplied severity vector.
What does an attacker need to include in a malicious file?
The crafted .hmp file needs an HMP chunk length between 0 and 12. This underflows during parsing, wrapping the length to approximately 4 GB and causing reads beyond the intended heap buffer.
What impact can be observed?
Parsing the malformed file can crash the application. Heap data may also be exposed through WildMidi_GetInfo().
How can I determine whether my deployment is affected?
Check whether the application uses WildMIDI version 0.5.0 or earlier and accepts or processes .hmp files from untrusted sources. Test only in a controlled environment with a file containing an HMP chunk length in the 0–12 range.